PHP Critical RCE Flaws: Emergency Patches Due October 21

As reported by Ars Technica, an unconfirmed report showed a video of an exploit tool called PHP2Shell executing code on web servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9, all of which use PHP. Ars Technica said it could not locate the original report.

The timing has security firms on edge. Researchers at Sansec said they expect mass attacks to start within 15 minutes of the patch release, while Webfence, Huntress and watchTowr have all issued advisories urging admins to prepare. Ars Technica cited one security researcher who estimated that around 1.3 million internet-connected hosts are likely affected.

Recommended preparation includes identifying who manages PHP inside your organization, inventorying every app built on the language, and planning a maintenance window from 14:00 UTC with a contingency for an earlier release. Backing up site and database files before patching is also advised, and some experts suggest unplugging non-essential systems until fixes are installed.

Administrators should monitor the PHP.net homepage and the project's ANNOUNCE mailing list for late-breaking changes, including an earlier release time. Given the leaked information, anyone responsible for a PHP-based site or internal tool should treat this as an urgent update rather than a routine one.

If you run a website, a shop or an internal tool built on PHP, WordPress, Joomla, Drupal or similar platforms, this is a patch you should not delay. The updates are expected tomorrow at 14:00 UTC, but PHP may ship them sooner, so check for updates throughout the day and apply them as soon as they appear.

For readers in Tunisia, there is no specific local advisory yet, but any hosting provider, agency or business running PHP-based services should plan a maintenance window and confirm who is responsible for applying the patch. watchTowr, Sansec and other firms describe the flaws as real and severe, even though no active exploitation has been confirmed so far.